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DETAILED ACTION 

* 

1 . Claims 1-49 are pending. Claims 42-49 have been withdrawn from consideration 
due to an election without traverse of claims 1-41 . 

Claim Objections 

2. Claim 24 is objected to because of the following informalities: Claim 24 should 
read "a computer system to." Appropriate correction is required. 

* • 

Claim Rejections - 35 USC §112 
The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

3. Claim 20 is rejected under 35 U.S.C. 112. second paragraph, as being indefinite 
forfaiting to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. 

4. Claim 20 recites the limitation "the user." There is insufficient antecedent basis 
for this limitation in the claim. 
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Claim Rejections - 35 USC § 102 

5. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

ft 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

6. Claims 1-4, 6, 8, 10, 19, 21-26 rejected under 35 U.S.C. 102(e) as being 
anticipated by Hursey et al US Patent No. 7,107,617. 

7. . With regards to claims 1, 22, 24-25, Hursey teaches a method of screening a 
software file for viral infection (Hursey, column 3 lines 15-40, scan for viruses using 
virus definitions) the method comprising defining a database of known infected file 
signatures (Hursey, Figure 1 Item 12 - virus definitions), determining a signature for a 
file (Hursey, column 3 lines 57-67, determines manner of compression of file and data 
relating to the file) and screening that signature against the signatures contained in said 
database to determine if there is a match (Hursey, column 4 lines 1-17, compares file to 
virus signatures). 

8. With regards to claim 2, Hursey teaches a match of signatures between the 
screened file and said database results in an action affecting the said screened file 
(Hursey, column 4 lines 13-16, if there is a match, actions are triggered for file). 
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9. With regards to claim 3, Hursey teaches the result of a non matching signature 
between the screened file and said database results in an action affecting the said 
screened file (Hursey. column 4 lines 16-25, screens file again against another 
signature, column 3 lines 5-10 allows continued file access). 

10. With regards to claim 4, Hursey teaches the result of a non matching signature 
between the screened file and said database results in an action affecting the said 
database (Hursey, column 4 lines 16-25, moves to next signature). 

1 1 . With regards to claims 6, 27, Hursey teaches a match of signatures between 
the screened file and said database result in an alert or notification to a user of a local 
computer system (Hursey. column S lines 1-15, alert message generation). 

12. With regards to claims 8 and 19, Hursey teaches said action is an electronic 
quarantine of said matched file (Hursey, column 3 lines 1-15, quarantine). 

13. With regards to claim 10, Hursey teaches the database contains a flag set in 
memory to quarantine said screened files (Hursey, column 3 lines 1-15, file is sent to 
quarantine and file access requests are disallowed). 

14. With regards to claim 12, Hursey teaches the database contains a flag set in 
memory to erase said files (Hursey, column 3 lines 1-15, deletion). 

15. With regards to claims 21, 23, 26, Hursey teaches the step of determining a 
signature for the file and screening that signature comprises deriving a signature of the 
file and comparing the derived signature with signatures'in the database (Hursey, 
column 3 lines 53-67, identifies file and compression type to determine signature of file 
to compare to database of virus signatures). 
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Claim Rejections • 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) vyhich forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

16. Claims 5, 7, 9, 11, 13-18, 28 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Hursey et al US Patent No. 7,107,617 in view of Halperin US PGPub 
2004/0111632. . 

17. With regards to claim 5, Hursey fails to teach a match of signatures between 
the screened file and said database result in an action affecting the database. 
However, Halperin teaches a match of signatures between the screened file and said 
database result in an action affecting the database (Halperin, paragraphs 0087-008. 
virus outbreak database logs all matches). At the time the invention was made, it would 
have been obvious to a person of ordinary skill in the art to utilize Halperin's method of 
taking action with the database based upon a match because it offers the advantage of 
allowing the determination of viruses that are spreading across multiple systems 
(Halperin, paragraph 0090). 

18. With regards to claims 7, 9 and 20, Hursey fails to teach the computer system 
is connected via an electronic link to a remote central computer and wherein the 
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and the remote central computer. However, Halperin teaches teach the computer 
system is connected via an electronic link to a remote central computer and wherein the 
database is updated via an electronic link between the computer hosting the database 
and the remote central computer (Halperin, paragraph 0087, receives relevant updates 
from antivirus vendor). At the time the invention was made, it would have been obvious 
to a person of ordinary skill in the art to utilize Halperin's method of interfacing with a 
remote central computer because it allows updating of virus definitions that allow 
greater likelihood of finding a new virus (Halperin. paragraph 0087). 

19. With regards to claim 11, Hursey fails to teach the database containing a flag 

■ ♦ 

set in memory to release quarantine files. However, Halperin teaches a database 
containing a flag set in memory to release quarantine files (Halperin, paragraph 0058, 
administrator determines whether to remove quarantine and allow message to 
foHA/arded), At the time the invention was made, it would have been obvious to a 
person of ordinary skill in the art to utilize Halperin's method of removing quarantine 
flags because it offers the advantage of allowing the passing of a message that is not 
actually infected and was classified as infected inadvertently (Halperin, paragraph 
0058). 

20. With regards to claims 13-18, Hursey fails to teach the flag can be updated by 
remove software via an electronic link to end user computers. However, Halperin 
teaches the flag can be updated by remove software via an electronic link to end user 
computers (Halperin, paragraph 0058, administrator may remove quarantine and 
designate file as uninfected). At the time the invention was made, it would have been 
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obvious to a person of ordinary skill in the art to utilize Halperin's method of removing 
quarantine flags because it offers the advantage of allowing the passing of a message 
that is not actually infected and was classified as infected inadvertently (Halperin, 
paragraph 0058). 

21 . With regards to claim 28, Hursey teaches the sending of an alert or notification 
following a match condition (Hursey, column 3 lines 1-10), but fails to teach the 
notification sent to a network administrator of a remote server However. Halperin 
teaches the notification sent to a network administrator of a remote server (Halperin, 
paragraph 0058). At the time the invention was made, it would have been obvious to a 
person of ordinary skill in the art to utilize Halperin's method of informing network 
administrators because it offers the advantage of allowing the passing of a message 
that is not actually infected and was classified as infected inadvertently (Halperin, 
paragraph 0058). 

22. Claims 29-36 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Hursey et al US Patent No. 7,107,617 in view of Fakes et al US PGPub 2005/0125694. 

23. With regards to claims 29-32, Hursey fails to teach the apparatus being a part 
of a network firewall device, network intrusion detection system, network packet sniffer 
software, or network intrusion prevention system. However, Fakes teaches the 
apparatus being a part of a network firewall device, network intrusion detection system, 

■ * 

or network intrusion prevention system (Fakes, paragraph 0019). At the time the 
invention was made, it would have been obvious to a person of ordinary skill in the art to 
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utilize Fakes' method if implementing virus scanning because it offers the advantage of 
helping to prevent the propagation of malicious programs over the network (Fakes, 
paragraph 0019). 

24. With regards to claims 33-36, Hursey fails to teach the apparatus being a part 
of a PDA, digital camera, cellular phone, or wireless device. However, Fakes teaches 
teach the apparatus being a part of a PDA, digital camera, cellular phone, or wireless 
device (Fakes, paragraph 0019). At the time the invention was made, it would have 
been obvious to a person of ordinary skill in the art to utilize Fakes' method if 
implementing virus scanning because it offers the advantage of helping to prevent the 
propagation of malicious programs over the network (Fakes, paragraph 0019). 

25. Claims 38-39 are rejected under 35 U.S.C. 103(a) as being unpatentable over 

Hursey et al US Patent No. 7,107.617 in view of Waldin et al US Patent No. 6,094,731. 

■• 

26. With regards to claim 38, Hursey fails to teach the database being part of a 
bidirectional system for sending and receiving partial hash signatures. However, Waldin 
teaches a database being part of a bidirectional system for sending and receiving partial 
hash signatures (Waldin, column 3 lines 1-20 and 55-65). At the time the invention was 
made, it would have been obvious to a person of ordinary skill in the art to utilize 
Waldin's partial hash signature method because it offers the advantage of increasing 
the speed and performance of virus scanning (Waldin, column 3 lines 1-5). 
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27. With regards to claim 39, Hursey as modified teaches partial hash signatures 
are sent and received through a bidirectional request protocol set to determine a 
percentage of said file used in hash computation (Waldin, column 4 lines 40-67). 

Allowable Subject Matter 

28. Claims 40-41 are objected to as being dependent upon a rejected base claim, 
but would be allowable if rewritten in independent form including all of the limitations of 
the base claim and any intervening claims. 

* 

The following is a statement of reasons for the indication of allowable subject 
matter: the cited prior art fails to teach or suggest the requested percentage being 
based upon communication speed or file size. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Andrew L. Nalven whose telephone number is 571 272 
3839. The examiner can normally be reached on. Monday - Thursday 8-6. Alternate 
Fridays. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kambiz Zand can be reached on 571 272 381 1 . The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding tlie status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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